DIGITAL FORENSIC INVESTIGATION OF CLOUD STORAGE SERVICES

Transcription

1 DIGITAL FORENSIC INVESTIGATION OF CLOUD STORAGE SERVICES Hyunji Chung, Jungheum Park, Sangjin Lee, Cheulhoon Kang Presented by: Abdiwahid Abubakar Ahmed, ID #

2 2 OUTLINE 1. Introduction 2. Cloud storage services and digital forensics 3. Artifacts of cloud storage services (Windows and Mac) 4. Artifacts of cloud storage services (smartphones) 5. Case study of a cloud storage service 6. Discussion and conclusions

3 3

4 4 CLOUD COMPUTING: Computing resources delivered as a service over a network The name comes from the cloud-shaped source:

5 5 1. INTRODUCTION Cloud computing was expanded: Development of an information technology infrastructure Availability of free software and advanced virtualization technology CC services divisions (in terms of resources provided): SaaS (software as a service) PaaS (platform as a service) IaaS (infrastructure as a service).

6 6 SaaS (SOFTWARE as a SERVICE) software delivery model in which software and associated data are centrally hosted on the cloud typically accessed via a web browser.

7 7 PaaS (PLATFORM as a SERVICE) The provider provides the networks, servers, storage and as a service. The consumer creates the software, deployment and make configuration.

8 8 IaaS (INFRASTRUCTURE as a SERVICE) Providers offer computers and other resources on-demand. Users install operating-system images and their applications infrastructure, patch and maintain the OS and the softwares.

9 9 CLOUD STORAGE A type of IaaS, provide users with virtual space which allows users to store data such as documents, images, and music files. It also offers additional services such as editing, player, and -sending capacity. Accessible from PC or a smartphone and this helped the expansion of cloud storage.

10 10 WHERE WE CAN FIND DF INFORMATION hosting companies keep confidentiality. We can analyze traces stored in user s device. conventional digital forensic methods are insufficient. We combine conventional computer forensics with mobile forensics to get useful information.

11 11 McClain, 2011 Dropbox traces Windows installation directory registry changes on installation network activity database files log files, and uninstallation data what kind of data exists how they can be utilized to investigate did not explain specifically Dropbox traces in smartphones Dropbox can be accessed via a smartphone

12 12 HOW IS THIS PAPER ORGANIZED It looks traces left in local devices (PC and smartphones). All devices for a single user s cloud storage must be examined when conducting digital forensics It presents methods for collecting and analyzing evidence about a variety of the cloud storage services currently available.

13 13 HOW IS THIS PAPER ORGANIZED Section 2 discusses methods for forensic investigation of cloud storage services, and important factors that should be considered in a forensic investigation. Section 3 deals with the traces that are created with a Windows and Mac system. Section 4 deals with the traces that are left when ios and Android OS for smartphone are used

14 14 HOW IS THIS PAPER ORGANIZED Section 5 presents a crime scenario involving a cloudstorage service and describes an investigation method. Section 6 presents the conclusions

15 15 2. CLOUD STORAGE SERVICES AND DIGITAL FORENSICS Cloud storage services A type of IaaS Their use is increasing can be accessed through a Web browser Available in different platforms The artifacts in PCs and smartphones differ due to different services

16 16 Services demonstrated in this paper: Amazon S3, Google Docs,Dropbox, and Evernote. COMMON WAY TO USE Type of service Public services PC (Windows, Mac) Web browser or Client program Smartphone (ios, android) Application Data storage Office suite + data storage Note storage + data storage Amazon S3, Dropbox, Sugarsync, and so on Google Docs, SkyDrive Evernote, Awesome Note

17 2.1. PROCEDURE FOR DIGITAL INVESTIGATION OF CLOUD STORAGE SERVICES The investigator collects and analyzes data from all devices that a user has used to access a cloud storage service. Such devices include PCs, smartphones, tablet PCs, and PDAs, but this paper covers only PCs and smartphones, which are the mostly widely used devices. 17

18 PROCEDURE FOR INVESTIGATION OF A CLOUD STORAGE SERVICE 18 Figure 1, page 3

19 IMPORTANT FACTORS IN AN INVESTIGATION Log files of web browsers Internet Explorer and Firefox log files in profile directory. Cache - images, icons, text, HTML, XML files, download URLs, download times, and data sizes History - visited URLs, titles of Web pages, the times of visits, and the number of visits Cookie - hosts, paths, cookie modification & expiration times, names, and values and download - local paths of downloaded files, download URLs, file sizes, download times, and status This paper focuses on log files of Internet Explorer and Firefox

20 ARTIFACTS OF CLIENT APPLICATIONS IN PC Left traces in the registry, and log files and database files. Logins status Used or denied services & synchronization

21 ARTIFACTS IN SMARTPHONES Database files, XML files, and plist files Physical memory Information about users (IDs and passwords ) Collecting physical memory is possible when doing live forensics. This is beyond the focus of this paper

22 22

23 3. ARTIFACTS OF CLOUD STORAGE SERVICES (WINDOWS AND MAC) 3.1. AMAZON S3 Amazon S3 is a Web-based cloud storage service and provides various APIs. Many cloud storage services are built using APIs. 23

24 WINDOWS [IE 8.0] 24

25 WINDOWS [IE 8.0] The first and second fields in this file are the user s canonical ID and bucket name The third field is the time at which the user performed the action. The seventh field describes the user s action. The eighth field is the name of the file on which the user acted. The last field is the HTTP user-agent value

26 MAC [Firefox 9.0.1] Possibility of uploading, downloading files & logging General forensic tools are needed for investigation The artifacts of Amazon S3 are deleted when browser is closed. EnCase can be used to restore.

27 DROPBOX A frequently used cloud storage service. Allows sync and the user can access their storage using Windows, Mac, iphones, and Android

28 WINDOWS 28

29 29 The investigator can find the suspect s dropbox_path by copying config.db to that PC, and then places config.db in the same path as the suspect s dropbox_path.

30 EVERNOTE Evernote allows a user to store an idea anywhere and anytime. Evernote synchronizes notes every time they are saved. Accessible through Windows, Mac, iphones, and Android smartphones.

31 WINDOWS Title Date_cre ated Date_upd ated is_delete d Source Latitude Longitud e Evernote test Mobile.a ndroid Table 8 [userid].exb.

32 WINDOWS 32

33 33 The file [userid].exb.thumbnails is a combination of PNG files that take a snapshot of the note at every synchronization.

34 34 AppLog_[Date].txt is created once a day when Evernote starts. Inside it is the authentication information, the account ID, and start and end time. enclipper_[date].txt is created once a day, like AppLog_[Date].txt. It includes application start time.

35 MAC Important four files in Appendix B are Evernote.sql, fullscreenthumbnail.png, thumbnail.png, and Evernote.log.

36 36

37 3.4. GOOGLE DOCS Web-based service that offers flexibility to be productive from one s desk, on the road, at home and on a mobile phone. Originaly classified as a SaaS 37 Recently begun to support mobile access by iphone and Android.

38 Windows 38

39 39 4. Artifacts of cloud storage services (smartphones) Amazon S3

40 40

41 41 5. CASE STUDY OF A CLOUD STORAGE SERVICE 5.1. Case overview In 2011, documents containing designs for a new product had been leaked to a competitor. The file name is A_design.pdf. prime suspect was a Mr. K, credential files manager. After checking data logs there were no trace remained Mr. K PC and Android became target devices. The PC and smartphone were seized for forensic examination. PC was Windows 7 and the mobile was Android.

42 Objective judge whether or not Mr. K had leaked a secret file by investigating his PC and smartphone Method The investigation started with Mr. K s PC. The leaked file was not detected. issued a search and seizure warrant. The investigator realized that the suspect used Dropbox The suspect found

43 RESULTS Confidential file using Dropbox. Further examining the prime suspect s PC and smartphone together, more precise investigation was possible.

44 44 6. DISCUSSION AND CONCLUSIONS The availability of cloud storage has spread of cloud storage services. possible for malicious users to abuse cloud storage services Until now, artifact examination can be done only in PCs. This method fails to provide information not available in the PC. This paper has proposed a process model

45 45 6. DISCUSSION AND CONCLUSIONS For forensic investigation of cloud storage services It described some important elements of an investigation. It also described a previously unknown method for forensic analysis of cloud storage services. This methodology is helpful in the investigation of cloud storage services.

46 THANK YOU Q & A